#1956 - Escape LIKE queries (for _ and %).

In MySQL queries, _ and % characters are treated as wildcards (similar to ? and *, respectively).
- Added escape_for_like function to MY_Database.php
- Added unit test to Database_Test
- Corrected the five unescaped instances in the code using this function.

1 files changed, 1 insertions, 1 deletions

diff --git a/modules/tag/controllers/tags.php b/modules/tag/controllers/tags.php
index 77ad7f50..77d45a95 100644
--- a/modules/tag/controllers/tags.php
+++ b/modules/tag/controllers/tags.php
@@ -52,7 +52,7 @@ class Tags_Controller extends Controller {
     $limit = Input::instance()->get("limit");
     $tag_part = ltrim(end($tag_parts));
     $tag_list = ORM::factory("tag")
-      ->where("name", "LIKE", "{$tag_part}%")
+      ->where("name", "LIKE", Database::escape_for_like($tag_part) . "%")
       ->order_by("name", "ASC")
       ->limit($limit)
       ->find_all();